fix(updater): pull tap before brew upgrade to ensure latest formula

Without pulling the tap first, HOMEBREW_NO_AUTO_UPDATE=1 would prevent
brew from seeing new versions. Now we do a targeted git pull on the
openbootdotdev/tap repo before upgrading, matching opencode's approach.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: fullstackjam

internal/updater/updater.go

@@ -280,11 +280,19 @@ func getHTTPClient() *http.Client {
 	return httpClient
 }
 
+const brewTap = "openbootdotdev/tap"
+const brewFormula = brewTap + "/openboot"
+
 // execBrewUpgrade is a package-level variable to allow test injection.
-// HOMEBREW_NO_AUTO_UPDATE=1 prevents brew from doing a full `brew update`
-// (fetching all formula updates) before upgrading, which would be slow and noisy.
+// It pulls the tap first (to get the latest formula without a full `brew update`)
+// then upgrades the formula. HOMEBREW_NO_AUTO_UPDATE=1 prevents brew from doing
+// a slow full update of all taps.
 var execBrewUpgrade = func(formula string) error {
-	cmd := exec.Command("brew", "upgrade", formula)
+	script := fmt.Sprintf(
+		`git -C "$(brew --repo %s)" pull --ff-only && brew upgrade %s`,
+		brewTap, formula,
+	)
+	cmd := exec.Command("sh", "-c", script)
 	cmd.Env = append(os.Environ(), "HOMEBREW_NO_AUTO_UPDATE=1")
 	return cmd.Run()
 }
@@ -302,7 +310,7 @@ func homebrewAutoUpgrade(currentVersion string) {
 
 	latestClean := trimVersionPrefix(state.LatestVersion)
 	ui.Info(fmt.Sprintf("Updating OpenBoot v%s → v%s via Homebrew...", currentVersion, latestClean))
-	if err := execBrewUpgrade("openboot"); err != nil {
+	if err := execBrewUpgrade(brewFormula); err != nil {
 		ui.Warn(fmt.Sprintf("Auto-update failed: %v", err))
 		ui.Muted("Run 'brew upgrade openboot' to update manually")
 		fmt.Println()

internal/updater/updater_test.go

@@ -360,7 +360,7 @@ func TestHomebrewAutoUpgrade_UpdateAvailable_Success(t *testing.T) {
 
 	homebrewAutoUpgrade("1.0.0")
 
-	assert.Equal(t, "openboot", calledWith, "should call brew upgrade openboot")
+	assert.Equal(t, brewFormula, calledWith, "should call brew upgrade with fully-qualified formula")
 }
 
 func TestHomebrewAutoUpgrade_UpdateAvailable_Failure(t *testing.T) {